Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:62975
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.210.170 as permitted sender)
MIME-Version: 1.0
Sender: nicolas.grekas@gmail.com
In-Reply-To: <CAAyV7nEP2RRcd+dD9PuqGPR=yMMoyMDK2SqepuZMr3EHh8TD9A@mail.gmail.com>
References: <CAOWwgpmNd=aGRN4oXrjQZB5LDsdpptsswGLHCC5HQHy=ETop4g@mail.gmail.com>
 <CAAyV7nEP2RRcd+dD9PuqGPR=yMMoyMDK2SqepuZMr3EHh8TD9A@mail.gmail.com>
Date: Thu, 13 Sep 2012 14:04:15 +0200
Message-ID: <CAOWwgpnt2hBJBTMq=OM-KJPdKz=GA1Eex1L8W+d0P-=N0nAXkg@mail.gmail.com>
To: Anthony Ferrara <ircmaxell@gmail.com>
Cc: internals@lists.php.net
Content-Type: multipart/alternative; boundary=14dae9340bc76c627a04c9941ca3
Subject: Re: [PHP-DEV] How about adding PHPass compatibility to the password
 hashing API
From: nicolas.grekas+php@gmail.com (Nicolas Grekas)

--14dae9340bc76c627a04c9941ca3
Content-Type: text/plain; charset=ISO-8859-1

>
> With respect to adding those algorithms for generating hashes, I'm 100%
> dead set against it.
>

Ok, I understand and agree, generating hashes for weaker algos is not a
good idea.

The point I wanted to address was forward/backward compatibility with
existing password databases that use PHPass :



> The way password_verify is implemented, it can use any crypt(3) generated
> hash for verification.
>

So forward/backward backward compatibility is granted for CRYPT_EXT_DES,
well done.

Still, for md5 based hashes ($P$/$H$ prefixes), crypt() doesn't work.
What about handling these schemes only in password_verify() ?

I think that could help a lot on adoption rate for the new API, easing the
transition for current phpass users.


Nicolas

--14dae9340bc76c627a04c9941ca3--